ON THE AVERAGE EXPONENT OF ELLIPTIC CURVES MODULO p 

TRISTAN FREIBERG AND PAR KURLBERG 

'fvj'. Abstract. Given an elliptic curve E defined over Q and a prime p of good reduction, let 

E{^p) denote the group of Fp-points of the reduction of E modulo p, and let Cp denote the 

^D . exponent of this group. Assuming a certain form of the Generalized Riemann Hypothesis 

^^ ■ (GRH), we study the average of ep as p ^ X ranges over primes of good reduction, and find 

O ■ that the average exponent essentially equals p ■ ce, where the constant ce > depends on 

2r ' E. For E without complex multiplication (CM), ce can be written as a rational number 

(depending on E) times a universal constant, c :— Y[„ ( 1 — ( 2_iu 5_ii ) , the product being 
over all primes q. Without assuming GRH, we can determine the average exponent when E 
has CM, as well as give an upper bound on the average in the non-CM case. 



Q 






^ 



1. Introduction 



J3 ■ Given an elliptic curve E defined over Q, and a prime p for which E has good reduction, 

let E{¥p) denote the group of Fp-points of the reduction of E modulo p. The behavior of 
E{¥p) as p varies over the primes has received considerable attention — the oscillations of 
^ . the cardinalities |£'(Fp)| is a central question in modern number theory, and the structure of 

CN . E(¥p) as a group, for example, the existence of large cyclic subgroups, especially of prime 

order, is of interest because of applications to elliptic curve cryptography [10, 12]. 
Tj- 1 If p is a prime of good reduction then E(¥p) = Z/dpZ x Z/e^Z for uniquely determined 

ff^ ■ integers dp, Cp, with dp \ Cp. The size of the maximal cyclic subgroup, that is the exponent, 

^ ■ of E{¥p) is therefore Cp. For primes p of bad reduction we set Cp = 0. The purpose of 

this paper, motivated by a question of Joseph Silverman (personal communication), is to 
investigate the average of Cp as p varies. Conditional on a certain form of the Generalized 
Riemann Hypothesis (GRH), we will show that there exists ce G (0, 1) such that 



y Cp ^ Ce ■ Li {X^^ as X — )■ cxo, 

where Li (X^) := J^ dt/(logt) is the logarithmic integral of X^. Since ^p<^xP ~ Li (X^) 
(by partial summation and the prime number theorem), we may interpret this as the average 
value of Cp being p ■ ce- 

Before stating our main theorem we explain what we mean by GRH. Given a positive 
integer k, let Lk denote the fc-division field of E, that is, the number field obtained by 
adjoining to Q the coordinates of all points in E[k], the subgroup of /c-torsion of points of E. 
Let C-Lfcl-s) denote the Dedekind zeta function associated with Lk. We say that CLk{s) satisfies 
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the Riemann Hypothesis (RH) if all zeros with positive real part lie on the line Re(s) = 1/2. 
By GRH we will here, and in what follows, mean that the Riemann Hypothesis holds for (^l*. 
for all positive integers k. 

Theorem 1.1. Given an elliptic curve E defined over Q, there exists a number ce G (0, 1) 
such that on GRH we have 

for X ^ 2. The implied constant depends on E at most. 

Settling for a weaker error term, we can remove the GRH assumption for CM-curves. 

Theorem 1.2. Let E be an elliptic curve defined over Q with complex multiplication, and 
let Ce be as in Theorem 1.1. For X ^ 3, we have 

The implied constant depends on E at most. 

{Note added in proof: The error terms in Theorems 1.1 and 1.2 have recently been improved 
by Wu [22] and Kim [9]. See Section 8 for details.) 

For non-CM curves we can give an unconditional upper bound of the correct order of 
magnitude. In the following theorem, we use the notation F{X) < G{X), which means that 
limsup^^^F(X)/G(X)^l. 

Theorem 1.3. Let E be an elliptic curve defined overQ, and let Ce as in Theorem 1.1. As 
X tends to infinity, we have 

Y,e,<CE-U{X'). 

We will now describe ce in more detail. With n^^ '■= [L^ : Q] denoting the degree of 
the extension Lk/Q, u{k) the number of distinct prime factors of k, (pik) the Euler totient 
function of k, and Ta.d{k) the largest squarefree divisor of /c, we have (whether or not E has 
CM) 

^^ ._ y^ (-l)-^^V(rad(A:)) 

In Lemma 3.5 below, we will show that this sum is absolutely convergent, and that Ce G (0, 1). 
If E does not have CM, there exists a universal constant 



3 



^ - n (l - (,2_i)(,5_i) j = 0.8992282528 . . . , (1.2) 

such that ce/c is a rational number depending only on E. If E has CM by an order D 
in a imaginary quadratic number field K, Ce can similarly be written as a rational number 
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(depending on E) times an Euler product, depending only on K, of the form 

-I--I- [}' q'il-l/qMl-l/q^)) ' ^^ V' ~ g2(l + 1 /g)(l _ l/g3) 

g splits in X ^ ^ ^ '^^^ / "i J / g inert in X ^ ^ ^ '^^^ '^ ' 

We will indicate how to prove the last two statements in Section 7. 

1.1. Background and discussion. The multiplicative order of a number modulo p. Given a 
rational number (7 7^ 0, ±1 and a prime p, let lg{p) denote the multiplicative order oi g modulo 
p (unless p divides ab, where g = a/b, a,b coprime, in which case set lg{p) = 0). In [11], 
the second author and Pomerance, on assuming the Riemann hypothesis for Dedekind zeta 
functions associated with certain Kummer extensions, determined the average of lg{p) as 
p ^ X ranges over primes by showing that 



E 



/,(p) = C, . Li (A-) + O ( (|„g_y)3/2^V,o„„,.ogA- ) 



where Cg can be expressed in terms of the degrees of certain Kummer extensions, namely 

__^ (-l)"W0(fc)rad(fc) _>^ (-l)"W0(rad(fc)) 

Thus, even though we consider two rather different quantities associated with groups 
modulo p, namely the multiplicative order of a fixed element modulo p and the exponent of 
an elliptic curve modulo p, the sums defining Cg and Ce are very similar; the only difference 
is that degrees of Kummer fields replace degrees of /c-divison fields. (Note that the exponent 
fluctuations for (Z/pZ)^ are essentially trivial since the group is cyclic.) Further, Cg can also 
be written as the product of a rational number (depending on g) times a universal constant, 
namely C := Ylqi^ ~ l/i.'f ~ 1)) = 0.5759599689 . . . (the product being over all primes q). 

Upper and lower bounds on Cp. As p — )■ 00, Basse's bound implies that \E{¥p)\/p ~ 1 
which, together with the rank of E{¥p) being at most two, implies that y^ -^ Cp -^ p. For E 
any non-CM curve, Schoof [15] improved the lower bound to Cp ^ ^/p ■ logp/loglogp, and 
noted that this is unlikely to hold for CM curves since the curve E defined hj y^ = x^ — x 
has exponent Cp = ^p — 1 for any prime of the form p = (4?t,)^ + 1. 

If one removes zero density subsets of the primes, Duke [5] has significantly improved 
the lower bound. Namely, if / : M"*" — )■ IR+ is any increasing function tending to infinity, 
Cp > p/f{p) holds for 'almost all' primes, in the sense that it holds for all but o(7r(X)) primes 
p ^ X. (As usual, 7r{X) denotes the number of primes up to X.) For CM curves the result 
is unconditional, whereas for non-CM curves GRH is assumed. (For the latter he also shows 
that the weaker bound Cp > p^^^/logp holds unconditionally for almost all primes.) 

Finally we mention that Shparlinski [20] has shown that for any e > and p large, 
Cp ^ p^"" holds for almost all elliptic curves E in the family {-Ea,fe}a,6, where Ea,b denotes the 
curve y'^ = x^ + ax + b. 

The proportion of primes for which E{¥p) is cyclic. A question closely related to the 
size of the exponent is cyclicity — how often does the equality |£'(Fp)| = Cp hold? Borosh, 
Moreno and Porta [1] conjectured that E{¥p) is cyclic for infinitely many primes p, except in 
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certain cases where this cannot be so for 'trivial reasons'. Serre later proved [19], on GRH, 
that 



— - Y^ 1 ~ 4 as X ^ oo, 



E{¥p) is cyclic 

where Yl* denotes a sum restricted to p at which E has good reduction, and, with fi{k) 
denoting the Mobius function of k, c*^ = Yl'k=if^i^)/''^L,,- Furthermore, c^ > unless all 
2-torsion points on E are defined over Q, an obvious obstruction^ to E{¥p) being cyclic. 

Cojocaru and Murty [4] obtained versions of (1.3) with effective error terms, and in the 
special case in which E has CM, Murty [13] was quite remarkably able to establish (1.3) 
unconditionally (the proofs were later significantly simplified by Cojocaru [2]). 

For more background on this and related topics, we recommend the nice survey article [3] 
by Cojocaru. 

2. Outline of the proof of Theorem 1.1 

We begin by noting that our approach is in spirit a synthesis of the ideas in [11, 19], 
together with refinements by Murty [13] and Cojacaru [2]. 

As for notation, in this outline we shall use '~' to indicate equality with an implied error 
term, and p shall always denote a prime of good reduction. Recall that Cp = \E(¥p)\/dp, so 
if |-E(Fp)| =: p + 1 — ttp, then, since |ap| ^ 2y/p by Basse's inequality, we have 

We can treat the sum Ylp<x P/dp by using partial summation and the prime number theorem, 
once we have evaluated the sum Ylip^x T- 

Since dp \ Cp we have dp ^ |-E(Fp)| ^ iy/p + 1)^ by Basse's inequality, hence dp < 2\/X for 
p ^ X. As in [11], we use the elementary identity ^ = Ylhj\k ^^ ^° write 

Er-ZE^- E I^Ei- P-2) 

p^X P p^XhJldp -^ hj^2VX P^X 

hj\dp 

Now, by Lemma 3.1, a positive integer k divides dp if and only if p splits completely in Lk, 
and the Chebotarev density theorem (cf. Lemma 3.3) then gives 



El- E 



Li (A-) 



P<:X psgX ^'^ 

k\dp p splits completely 

in Lfc/Q 



"'^The only way for E{Q) to have a rationally defined subgroup isomorphic to Z/iZ x Z/iZ is if ^ = 2; this 
easily follows from the fact that E{M.) is isomorphic to either R/Z or Z/2Z x R/Z. 
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Thus, 

V mY^,^u(x) V M^.^^umf:'"''""'^'""'". (2-3) 

hj\dp 

The last error term in (2.3), and indeed showing that the last sum is absolutely convergent, 
involves bounding a sum of the type 'Yl,k>Y ~^- ^^ "^^ ^'^^^ ^'^ Lemma 3.4, but here lower 
bounds for ul^. are crucial. 

To give lower bounds on n^^, we use Serre's open image theorem [16,17]. If ii^ is a non-CM 
curve, compactness together with the image being open gives that the image of the absolute 
Galois group has finite index inside GL2(Z), hence n^j, S>_b (j){k)k^. If i? is a CM curve, a 
similar open image result of Serre gives that ul^ ^ 4>{k)'^- (Pot more details, see Proposition 
3.2.) 

Now, combining (2.1), (2.2), and (2.3), we obtain, via partial summation and the prime 
number theorem, that 

V- ^j.(y2^ ^ (-1)-W0(rad(fc)) 
2^e,^Li(X)-2^ ^— , 

p^X k=l '' 

which is the claimed main term. 

As for estimating the error terms, a slight complication arises — even assuming GRH, 
we cannot directly bound the sum of the error terms in the Chebotarev density theorem for 
'large' /c, that is, k G (VA/(logX)^, 2\/A]. To deal with this range Serre used the fact that 
the cyclotomic field Q(e^'^*/'') is contained in Lq] the sum can thus be restricted to primes 
p = 1 mod q, and Brun's sieve is then enough to bound the errors arising from the large 
k. However, to make an exponent saving in the error term we use a refinement of Serre's 
approach due to Cojacaru and Murty [4] (see Lemma 3.6 for further details.) 

3. Preliminaries 
In this section we collect some needed results on elliptic curves. 

Notation. Throughout, p, q, and i denote (rational) primes; h, j, k, and m denote positive 
integers. The arithmetic functions u, 0, rad, and /x have already been introduced; also, r(A;) 
is the number of divisors of k, and cr(/c) is the sum of the divisors of k. 

Whenever we write F = O (G), F -C G, or G ^ F, we mean that |-F| ^ c ■ G where c is 
an absolute positive constant. By F x G we mean that F ^ G ^ F. 

The logarithmic integral is defined for numbers t ^ 2 by Li (t) := J^ j^- 

We fix an elliptic curve F, defined over Q, of conductor A^. The results in this section 
relate to F. For primes p of good reduction (that is, p\ N), dp and Cp are the unique positive 
integers such that we have E(¥p) = Z/dpZ x Z/e^Z with dp \ Cp. Thus Cp is the exponent 
of F(Fp) iip\ N, and we set e^ = if p | A^. Also, \i p \ N , ap := p +1 - |F(Fp)|, and -Kp 
denotes a root of the polynomial X^ — a^X + p G Z[X]. 

The /c-division field of F is denoted L^; ni^ denotes the degree of the extension L^j 
and Al denotes its discriminant. 
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Lemma 3.1. If p\ kN then the following statements are equivalent. 

(1) E{¥p) contains a subgroup isomorphic to TLjkTL x Z//cZ. 

(2) p splits completely in Lk- 

(3) ^^^— is an algebraic integer. 

Proof. For the equivalence of (1) and (2), see [13, Lemma 2]. For the equivalence of (2) and 
(3), see [2, Lemma 2.2]. D 

We now give some estimates on the degree of the fc-division field of E. 

Proposition 3.2. (a) L^ contains Q(e^'^*/^) (the k-th cyclotomic field), hence p splits com- 
pletely in Lk only if p = 1 mod k. Also, (f>{k) divides ul,,- 

(b) ul, divides |GL2(Z/fcZ)| = fc^ n,|fc (1 - V?) (1 - V?')- 

(c) If E is a non-CM curve, then there exists a constant Be ^ 1, depending only on E, such 
that \GL2{'Zi/kZ)\ ^ Be ■ n^^ for every k. 

(d) IfE has CM, then (t){kf < ul^ ^ P. 

Proof, (a) See [21, Corollary 8.L1, Chapter III]. 

(b) First of all note that ul^ = |Gal(Lfc/Q) | as Lk/Q is a Galois extension. The action 
of the absolute Galois group Gal (Q/Q) on the fc-torsion subgroup E[k] of E induces a 
representation pE,k '■ Gal (Q/Q) — )■ Aut(ii^[/i;]) = GL2(Z/A;Z), which is injective. 

(c) With Ti{E) denoting the £-adic Tate module of E, the action of Gal (Q/Q) on 
Ue-^v^tiTeiE)) = YleGL2{Ze) induces a representation pe : Gal (Q/Q) -^ UiGUi^e)- By 
Serre's open image theorem [17, Theorem 3], the image of p^; is open, and since n£GL2(Z£) 
is compact, the image is of finite index. Since Gal (L^/Q) is isomorphic to the projection of 
lm.{pE), by the map Hf GL2(Z£) — )• GL2(Z//cZ), the result follows. 

(d) If E has CM, Serre's open image result for the CM case [17, Corollaire, Theoreme 5, 
p. 302] gives that ul^ ^ 0(^)^- (If E has CM by an order D, the image is open in H^^^' 
where De = D ^ Z^.) The upper bound follows from \{D/kO)^\ ^ k^. D 

Lemma 3.3. (a) There exist absolute constants ci,B > 0, such that the following statements 
hold, (i) If Cik^^N'^ ^ logX, then, whether or not E has CM, 

\{pi^X : p\N andk\dp]\ = ^^^-^ + O (Xexp (-5(logX)^/i^)) . (3.1) 

nit, 

(ii) Ifcik^N^ < logX and E has CM, then 

\{p^X : p\N andk\dp]\ = ^^^-^ + O (Xexp (-^(logX)^/^)) . (3.2) 

(b) Whether or not E has CM, for X ^ 2 we have, on CRH, that 

\{p^X : p\N andk\dp}\ = ^^^^ + O iX^'^ log(XiV)) . (3.3) 



Proof. Note that \i p ^ X and p \ N ^ then a priori we have k ^ 2yX for k \ dp, because 
dp I Cp and so dp ^ |-E'(Fp)| ^ {y/p + 1)^ by Basse's inequality. Since p \ dp (cf. [21, Exercise 
5.6(a), p. 145]), the conditions p \ N and k \ dp are equivalent to p \ kN and k \ dp, that is 
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p \ kN and E{¥p) contains a subgroup isomorphic to Z/A;Z x Z/A;Z. Therefore, by Lemma 
3.1, 

J2 l = \{p^X : p\N and k\dp}\+0 {\og{XN)), (3.4) 

pi:x 

p splits completely 
in Lk/Q 

where the O (log(XA^)) term is the neghgible contribution from the primes p dividing kN: 
u{kN) < log(A;A^) < log(X7V). 

(a) (i) As Lfc/Q is a Galois extension, an effective form of the Chebotarev density theorem 
(for example, see [14, Lemma 2]) gives 



^ 1^^.0(Xexp(-i.yiI)). (3^5) 



p splits completely 
in Lfc/Q 



where B is an absolute positive constant, provided 

c-max{nLjAij2/-^.,ni,(log|Aijf} ^logX, (3.6) 

for a certain absolute positive constant c. We claim that there is an absolute positive constant 
Ci such that if cik^^N"^ ^ log^, then (3.6) does indeed hold. In that case. Proposition 3.2(b) 
gives y/ni^ ^ k^ ^ (logX)^/''' (we may suppose that ci ^ 1), so applying this to the error 
term in (3.5) and combining with (3.4) gives (3.1). 

We now prove our claim. The first of the following sequence of inequalities holds with any 
Galois extension L/Q in place of Lk/Q [18, Proposition 6, p. 130]; the second holds because 
the ramified primes of Lk/Q are divisors of kN [21, Proposition 4.1(a), Chapter VII]: 

— ^ logriL^ + ^ logp ^ logn^^, + ^ logp ^ logra^^ + \og{kN). (3.7) 

* p ramifies in p\kN 

Lk/Q 

Our claim follows straightforwardly using this and the inequality riL^ ^ k^. 

(ii) Similar, but in the GM case we use the fact that n^^, ^ k"^, by Proposition 3.2(d). 
(b) By [18, Theoreme 4, p. 133], on GRH we have 

p splits completely 
in Lk/Q 

Applying (3.7) and the inequality ul^, ^ fc^ <^ X'^, we obtain (3.3) by putting this into 
(3.4). D 

Lemma 3.4. With Be as in Proposition 3.2(c), we have 

y^^\l/y zfEhasCM, 

f--; uli^ I Be/Y^ if E is a non-CM curve, 
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and 

y a{k)T{k) ^ { (log Y)/Y tf E has CM, ^^ ^^ 

f—^ kriLf^ I i?^(logF)/F^ if E is a non- CM curve. 

Proof. In the CM case we have, by Proposition 3.2(d), that 

y <yT77T?<^- (3-10) 

k>Y -^^ k>Y ^^ ' 

The last bound holds because 0(A;) ~ k 'on average'. It can be proved by entirely elementary 
means, the key being the identity t^ = XIjia; ^t)- ^^ spare the reader the details. Similarly, 

{q\k 



since |GL2(Z/fcZ)| = A;^ Iloife (1 - V?) (1 - 1/?^) > k^(t){k), Proposition 3.2(c) gives 



S-^^^^'^'S^^^^^) ^^^^ 



1 ^^B. 



in the non-CM case. 

Again if E has CM, we have 

^ a{k)T{k) ^ a{k)T{k) \ogY_ 
^ knu ^ k(j)(ky Y ' 

k>Y ^'^ k>Y ^^ ' 

One way to obtain the last bound is to establish that X]fc<y ^(^)''"(^) ^ F^logF, then 
apply partial summation to show that X]fc>y '^(^)''"(^)/^^ ^ (log^)/^) and use the identity 
T^ = ^,|fc ^^pY ^^° more times. Similarly, if E' is a non-CM curve, then 

,^ a{k)T{k) ..^sr ^(^)^(^) // ^i^iQg^ 
^ knu ^ ^Z^ fc40(^) ^ ya • 

D 

Lemma 3.5. The sum in (1.1) defining ce is absolutely convergent, and ce G (0, 1). 

Proof. Absolute convergence of the sum in (1.1) follows at once from (3.8). To show that 
Ce € (0, 1), first note that for every j ^ 1, Xl/i>i ^^^ ^e 1 by (3.8), because n^^^. ^ Ul^. 
Next, we claim that 

Er^^o 0>i)- (3-11) 

To see this, fix any j ^ 1 and any Y ^ j. Let Q = Ylq^Yl ^^^ ^^^ -^ t)e large enough in 
terms of Y and A^ so that logX ^ ci{QY)^'^N'^, where Ci is the constant of Lemma 3.3(a). 
Also assume that Xlhio 1/^(^)1 = 2^ ^ log-^- An inclusion-exclusion argument gives 



p\N,dp=j p\N, hj I dp 
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Applying Lemma 3.3(a)(i), we obtain 

Y, 1 ^ Li (X) ^ ^ + O (2^Xexp {-B{\ogXfl^^)) . 

P<X h\Q ^^f^^ 

p\N,dp=j 

Dividing by Li (X) and letting X tend to infinity, we find that 

O^limsup-^TTT y" l^V^. 

^^°° ^ ' p^X h\Q ^''^ 

p\N,dp=j 

Letting Y tend to infinity (cf. (3.8)), we obtain (3.11). 
Now, for any F ^ 1, 

j^Y h^l ^^i fc^l ^'^ hj=k fcsCV ^'' hj=k \k>Y ^'^ hj=k 

Since J2hj=kt^W vanishes unless k = 1, the main term here is just l/n^j = 1. Applying (3.9) 
to the 0-term (note that 'Yl,hj=k -'- ~ ''"(^) ^ (^{k)T{k)/k), then letting Y tend to infinity, we 
obtain 

EE^ = l- (3-12) 

Now since X]h|fc/^(^) ' ^ ~ (—1)'^^''^ (p{Tad{k)) , we have 



ce 



fc>l ^^ hj=k •' j^l •' h^l ^'^i 

convergence being assured by (3.8), (3.11) and (3.12). In view of (3.11), (3.12) and (3.13), 



we 



see that < c^ ^ 1. In fact recalling that c^ = X]/i>i ^^ is the cyclicity constant, we 



"L,, 



can deduce from (3.11) — (3.13) that ce G (0, 1] fl [c^, \{c*^ + 1)], with c^; = 1 if and only if 

c% = 1. However, that c^ < 1 can be seen by considering {p ^ X : p\ N and q > t}. By the 

Chebotarev density theorem (cf. Lemma 3.3(a) (i)) we have, for t ^ 2 and sufficiently large 

X, 

1 11 

\{p ^ X : p ] N, q \ dp ^ q > t}\ ^ 1-^tft-\{p^X : p f X and 2 | dp}\ < 1 



7r(X) "^ 7r(X) 2rai2 

On the other hand, using inclusion-exclusion, followed by Lemma 3.3(a) (i) and (3.8), one can 
show that 

-^ ■\{p^X:p\X,q\dp^q>t}\=c\^OE(^^OE (2*exp [-B{\ogXfl^')) . 

For suitable t = t{X) and sufficiently large X, comparing gives c^ < 1. D 

Lemma 3.6. (a) For X,Y ^ 2 we have 

\{p^X : p]N anddp>Y}\ <^ —^ + X^^HogX. (3.14) 
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(h) If E has CM and2<Y ^ logX, then 



X log log X 

yiogx 



\{p^X .-p^N and dp > Y}\ « ,,f_t • (3-15) 



Proof, (a) First of all note that since dp \ Cp, we have d^ ^ |_E(Fp)| ^ {^/p + 1)^ by Basse's 
inequality. Thus, ii p \ N and dp > Y then dp = k for some Y < k ^ 2yX. But dp = k 
implies k"^ \ {p + 1 — ap), and also k | p — 1 by Lemma 3.1 and Proposition 3.2(a); hence 
k \ Up — 2. Since ap ^ 2y^ by Basse's inequality, we therefore have 

E i« E E E 1+ E El 

P^^ Y<k^2VX \aU2'/X P^^ YKks^lVX P^^ 

p\N,dp>Y a^2 "■P="- «P=2 

a=2modfc fc2|p+l-a k^\p-l 



^^ Vx fx \ v^ fx 

« E — (j3 + ij+ E (ii + 

Y<ki:2VX y<fc!j2VX 

^3/2 V y-'il2 

< ^^ + VxiogX + - + v^ < ^^ + v^logX 

(Bere we have used the elementary bound X]fc>y ^~™ ^ yi-m^ j^ ^ 2.) 

(b) Suppose E has complex multiplication by an order in the imaginary quadratic field 



K = Q(a/— -D), D a squarefree positive integer. We begin with the following observation. 
Since p \ dp, the statement ^p \ N and k \ dp'' is equivalent to the statement 'p \ kN and p 
splits completely in Lk (Lemma 3.1). In that case p = 1 mod k by Proposition 3.2(a). If 
Qp = 0, then we also have p = —1 mod k, because k'^ \ dpCp = (p + 1 — ap). But we can only 
have both p = —1 mod k and p = 1 mod A; if /c = 1 or 2. Therefore, we necessarily have 
ap ^ when k \ dp and k ^ 3. Moreover, ^^^^ is an algebraic integer (Lemma 3.1), and since 
Q(7rp) = K when a^ 7^ (see [2, Lemma 2.3]), we have that ^^^^ G Or- 
Now, 



where 



{p ^ X : p t iV and rfp > r} C ^i(X) U ^2{X, Y) U ^3(>'), (3.16) 



^i(X) 

^2(x,r) 

^3(1^) 



{p ^ X : p f X and q \ dp for some q G (logX, 2v X]}, 
{p ^ X : p\ N and g | dp for some q G (F, logX]}, 
{p^X : p\ N, dp>Y, and q\ dp ^q ^Y} 
C {p<^X : p^ N,k\ dp for some A; G [F, F^]}. 
Since 2 < F ^ logX we have, by our initial observation, that 

'mi= E E i< E El- p-i^) 



n 



logX<gs:2VX P^'^ logX<qi:2y/X P<=^ 

p\N,q\dp ^^eO 



Since tt^ has norm p in K/Q, it follows that 

|^i(X)|< 5^ |5,(X;D,g)|, (3.18) 



logX<q^2VX 
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with 

Sj{X;D,k) := ip^X ■.p= (jk + iV + D UY P ioi some u,v E z\ , 



and j = 1 if -D = 2, 3 mod 4; j = 2 if -D = 1 mod 4. A trivial bound for \Si{X; D, q)\ will 
suffice here: 



^/X l^_^^ 



E l«,(.V;A,)l« E^(, 



«X V \ + Vx y - (3.19) 

q>logX^ gsJ2VX 

(log X) (log log X) 



(To obtain the last bound, apply partial summation and the prime number theorem to each 
sum.) 

We bound \lS^2{X^ Y)\ and \^^{Y)\ similarly, but we need the following non-trivial bound 

[2, Lemma 2.5]: 



\S,(X;DM«\^^l^ ^'°^'°^-^ 



fcv^log (^) 

provided k < yX — 1. Thus, 

|^2(X,F)|^ y \S,{X-D,q)\ 

Y<q^\ogX 

' y/X \ VXloglogX 



■c 



y4^o,X V ^ ^ V g^log (^) 



XloglogX ^ 1 yXloglogX ^ 1 



(3.20) 



X log log X 
^ (logX)riogF' 



and 
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\^,{Y)\^ Y, \SiiX;D,k)\ 
y<fc^y2 



« y 1^ + 1^ v^iogiogx 



< 



■c 



XloglogX ^ 1 v^loglogX ^ 1 



log (^ j y "y. "^ log (^^4-i ) y "y. 
X log log X yX(loglogX)(logr) 



Y = Y{X) :-- 



(logX)2/5- 

We proceed on GRH, so that partial summation applied to (3.3) gives 

5^ P = x 5^ 1- / (E pa i)dt 

p\ N, k\dp p\ N, k\dp 



r^L^ ^L^ J2 

Li (X^) 






O (X=^/2 log(XiV)) . 



(3.21) 



(logX)F logX 

Since Y ^ logX, putting (3.17) — (3.21) into (3.16), we obtain (3.15). D 

4. Proof of Theorem 1.1 

Let X ^ 2 and set 

XV5 



^^'^^^ ^ ^''Li(t)dt + 0(X3/2log(XiV)) ^^-^^ 



Here we have used that j:^ Li (t) dt = XLi (X) - Li (X^) + O (1). 

Recall that Cp = |-E(Fp) |/(ip = (p + 1 — ap)/dp ii p\ N, and by definition e^ = otherwise, 
hence 

p\N p\N 

Since |ap| ^ 2y^ by Basse's inequality, we have 

^0 := ^ IZ^ « 5^ Vp ^ ^1/2 5^ 1 ^ X'/'. (4.3) 

p^X P p<X p^X 

pfiV 

We write 

7-o-Ef- E ^+ E ^-^.+^.. 



p$A ^P p^X ^P p^X ^" 

pfA^ p'iN,dp(iY p\N,dp>Y 
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To bound £i, we apply (3.14), and then use the definition of Y: 

^.- E f<f E l«4:^H-^;^«X"/-(logX)«/». (4.4) 

p\N,dp>Y p\N,dp>Y 

We partition 7i, using the identity ^ = X^hjifc ^^' ^^ follows: 

r.- E pE^-EpE^- E P^^^:Tn-Sn. 

psgX fcjidp -^ p^X hj\dp -^ p^X hj\dp -^ 

p\N, dp i^Y p^N hjsiY p\N, dp >Y hji^Y 

We now consider Sn, making yet another partition: 

£n-EpE^+ E p5:^-£.^+^- 

pfiX hj\dp -^ psiX hj\dp -^ 

p\N hji^Y p\N hj^Y 

dp>Y'^ Y<dp(iY^ 

Next, we note that 

hj\dp •' j^Y •' h^Y/j j^Y •' 

hj^Y 

Thus, by (3.14) (with Y^ in place of F), and by the definition of Y , we have 

«--EpE^«^^Ei 

p^X hj\dp -^ psiX 

p\N hjiiY p\N 

dp>Y^ dp>Y^ 

Y5/2 

« ^ + X'/'Y\ogX « X''/''{\ogXf\ 

yd 



For £^i3, we use 



v^ AjW ^ Y^^Y^l ^ r(rfp) ^ dp ^ T{dp)a{dp) 
^ i ^ ^ 3 dp ^ i d„ 

hj\dp h\dp j\dp '^ j\dp 

hj^Y 



Thus, 



^13:= E pT. 



? 

p^X hj\dp -^ 

p\N hjsiY 

Y<dpiS:Y^ 



^ y^ T{dp)a{dp) ^ y^ T{k)a{k) ^ 
P<x P y<fc^Y2 ps:x 

p\N p\N,k\dp 

YKdp^Y'^ 



(4.5) 
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We apply (4.1) to the last sum, noting that Li (X^) ^ X^/logX. Then we use (3.9), as 
well as the bound X]fc<Y2 k ^ I2 log^dt <^ F^logF. (Apply partial summation to 
Ek^t^ikMk)'^tHogt.) Thus, 



y<fcs:y2 



p\ N, k\ dp 



" "'^ fc<y2 



logX^^ /,n^^ 



|^^ + X3/2(log(XA^))F2iogF if E has CM, 



^ + X^/^{\og{XN))Y^ log F. if E is a non-CM curve. 

Combining and using the definition of Y, we obtain 

f Xi9/iO(log(XiV))6/5 if E has CM, 

^^ ^ |5sX^/5(logX)''/5 + X^9/iO(iQg(^j^jY))6/5 if ^ is a non-CM curve. 

Finally we consider Tii. By (4.1), and since 



(4^6) 



E 



^,{h) 



EE 



/i(/i) 



fc^y hj=fc 



< 



E 



k<Y 



E 

h.7=fc 



Mh) 



«E^<>' 

fc=sy 



we have 



7^.-EpE 



fi{h) 



P^X hj\dp 
p^N hjsiY 



3 



E 



Kh) 



E p 



Li(^') E 



hj^Y 

fx{h) 1 



p!iX 

p t N, hj I dp 



(4.7) 



hj-HY 



J riL 



hj 



Now, for prime powers q^ we have 



E 



Kh) 1 



0{X'^/^Y\og{XN)). 



1-q 



Q-m qUi—I 



and so by multiplicativity we have 



v^ H'V"') ^ -j-- 



-1) 



uj(k) 



hj=k 



J 



g™! k 



q- 



11(^-1) 



q\k 



-l)^W0(rad(fc)) 



(Here, q'^\\k means that g™ | k but g'"+^ | /c.) Therefore, setting ce as in (1.1), and using 
(3.8), we obtain 



E 



/i(/i) 



^ CO 

— = E 



1 ^L, 

/iKy -^ ^hj fc=i 



.l)'^(fc)0(rad(A;)) 



V^^^. 



vfc>y 
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J0{1/Y) if E has CM, 
~ ^^ ^ |o (Be/Y^) he is a non-CM curve. 

Putting this into (4.7), then using the definition of Y, we obtain 
Tn = CE- Li [X^] 

^ {(iSw) + ^ {X''^''i^og{XN)r/') if E has CM, 

O [BEX'^/^ilogXy/^] + O (X^^/iO(log(XiV))3/5) if E is a non-CM curve. 

(4.8) 

Gathering the estimates (4.8), (4.6), (4.5), (4.4), (4.3), and (4.2), the largest error term 
being of size O {X^^/^'^{\og{XN))^/^), we obtain 

^ ep = Tn - (£"12 + £"13) +Si+So = CE-U (X^) + O {X'^/'''i\ogiXN)f') , 
pi:x 

plus O (i?£;X^/^(logX)^/^) if ii^ is a non-CM curve, this term being dominated by the other 
0-term once X ^ B^;. D 

5. Proof of Theorem 1.2 

We now fix an elliptic curve E defined over Q, of conductor A^. We suppose that E has 
complex multiplication by an order in the imaginary quadratic field K = Q(V— -D). We 
know that there are only nine possibilities for D, namely D G {1, 2, 3, 7, 11, 19, 43, 67, 163}. 
(See [21, Appendix C, §11].) 

Let ci be the absolute positive constant of Lemma 3.3(a), and let co,C2 be positive con- 
stants to be specified presently. Suppose X ^ exp (cqA^^) and set 

j_ 

Y = Y{X,N):=C2' ^ 



We choose Cq and C2 so that 2 < F < (log AT) ^/^ ^^^ 2ciY'^^N^ ^ logX. 
Similarly to (4.1), partial summation and Lemma 3.3(a) (ii) give 

E p = ^^^^ + 0(X^exp(-i?(logX)3/«)), (5.1) 

p>lN, k\dp 

provided cik^N"^ ^ logX. One of the error terms involved is 

"(E .a i-^)dt. 

2 ^ p^N,k\dp ^h J 



r-X 



We can apply (5.1) to J^^ , k^N'^'X' ' ' ) "^^5 but we can only apply a trivial bound to the rest 
of the integral: 

/•exp(cifc*Af2) /.cxp(cifc*Af2) 

/ (E pa l_Mi))dt< / tdt<exp(2ciA;8iV2N 

This is O (X) if A; < F^ because Ic^Y'^^N^ ^ logX. 
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We now proceed as in the proof of Theorem 1.1. The differences are as follows. Analogous 
with (4.4) and (4.5) we have, by (3.15), that 



p ^ X ^^ , .. ^^ loglogX 



^'- 2^ Tl'^Y 2^ ^ << wY ■ y2 ' (5-2) 



t/p " r ^ IokX F2 

^ p^X 

p\N,dp>Y p\N,dj,>Y 



and 



^.-EpEf^««-5:i«i^-!^- (5.3) 

P^X hj\dp •' psiX ^ 

p\N hj^Y p\N 

dp>Y'i dp>Y^ 

Analogous with (4.6) we have 

^13-= 2^ pz^— -^ z^ — ^ — Z^ P- 

pjAf /iK'^ p\N,k\dp 

Y<dpS:Y^ 

Since (5.1) holds uniformly for k ^ Y^ , we may apply it to the last sum to obtain 

We use (3.9) to bound the second last sum and an elementary bound for the last sum. Thus, 
we have 

^'» « i^ ■ ¥^ + ■^''=''P (-B(log^)''^) ■ YHogY« ^ . !^. (5.4) 
Analogous with (4.8), we have, by (5.1), 



'^11 ^= E^ E ^ = Li {X') (cE + O (^)) + rX^exp {-B{\ogXf') 
p^x hj\dp -^ ^ V // 

pfJV hjsiY 



pfJV hji:Y (5.5) 



Gathering the estimates (5.5), (5.4), (5.3), (5.2), and (4.2), we obtain 

5]] Cp = Til - (£^12 + ^13) + ^1 + ^0 
p^X 

.■ f^2\ r,f^^ /IokIokX logy 



JogX V >^^ Y 

Since F = (A^^^ logX)-'^/^^, the theorem follows. D 



on the average exponent of elliptic curves modulo p 17 

6. Proof of Theorem 1.3 

Let E be an elliptic curve defined over Q, of conductor A^. We make no assumptions as 
to whether or not E has CM. Let ci be the absolute positive constant of Lemma 3.3(a), and 
let Co, C2 be positive constants to be specified presently. Suppose X ^ exp (cqA^^) and set 



Y = Y{X,N):=C2\og 



IokX 



iV2 



We choose cq and C2 so that 2ci exp (42F) A^^ ^ logX. 
As in the proofs of the first two theorems, we have 



E-.= E f+ E f + EV-7^ + ^.+0(A-/=). (6.1) 

pfAT, dps;y p\N,dp>Y p\N 



Since dp ^ 2^, and since p = 1 mod j if dp = j by Proposition 3.2(a), we have 

E r= E 1 E i< E J E 1- 

p\ N, dp >Y p\ N, dp = j p=l mod j 

By the Brun-Titchmarsh inequality [6, Theorem 3.7], 



El ^-— \ ^^ — \ 1 A A ^^ — \ 1 A 

7 ^ ^ ^ 7 ' 0(j) iog(x/?) ^ logX ^ j(h(j) ^ r logX 

p=l mod J 

(cf. (3.10) for the last bound). Hence 

^.- E ^«A- 5: j^«^. (6.2) 

p^X P p^X P ^ 

p\N,dp>Y p\N,dp>Y 

We claim that, with ce as in (1.1) and Be as in Proposition 3.2(c), we have 

^^^CE-U{X') + 0U^) if E has CM, 

' " C£ ■ Li (X2) + O (^^ + ^^) if ^ is a non-CM curve. 

Here and in the next two instances, by F ^ G + O {H), we mean that either F — G < or 
^ F — G <^ H. The theorem follows by combining (6.3) and (6.2) with (6.1). 

Let us prove our claim. By an inclusion-exclusion argument, the following inequality holds 
for any number X ^ 2 and any integer Q: 

P<:X h\Q P<:X 

p\N,dp=j p\N, hj I dp 
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Thus, applying partial summation and (3.1) to the last sum (as we did to obtain (5.1)), and 
noting that XI/iIq 1/^(^)1 = 2'^^'^\ we obtain 

Y, p^Li {X') Y^i^ + O (2-(«)x2 exp {-B{\ogX)'/'')) , 

P<:X h\Q ^^^^ 

p\N,dp=j 

provided 2ci{hjy^N^ ^ logX for every h \ Q. 

We set Q = Q{Y) := Hg^y *?• Then logQ ~ 1^ as y — )■ oo by the prime number 
theorem, and we may suppose that X and Y are large enough so that QY ^ exp {3Y), that 
is 2ci{QYY'^N'^ ^ 2ci exp (42F) A^^ ^ logX (by definition of Y and our choice of constants). 

Thus, since 2'^^^'' = 2^ < (logX)^/^^ and since Y.j<:y - < logF < log log log X, we have 

p\N,dp<:Y p\N,dp=j 



^ Li {X') YYt^ + O (X^exp (-l5(logX)5/i4)) 



(6.4) 



j^Y h\Q 

Letting S = {hj : h \ Q and j ^ Y}, we have 



J^'L,, 



j<:Y h\Q -^ ^^^ kaS ^^ hj=k -^ fces -^'^ h\k 



h. 



We complete the sum over k, noting that k ^ S implies either k > Y or k = hj with fi{h) = 0, 
and that ^^^fJ'ih) ■ h = {—l)'^^'''^(f){ra.d{k)), obtaining 

yy^h) _ y (-l)-(^)0(rad(fc)) ^^fy 1 ^ 

f0{l/Y) if E has CM, 
~'^^^ [O {Be/Y^) if E is a non-CM curve. 

by (3.8). Combining this with (6.4) gives (6.3). D 

7. Further remarks on the constant ce 

Notation in this section is as in the proof of Proposition 3.2. Let us first assume that E is 
a non-CM curve. Let G = limGL2(Z,/?7,Z) = ]^^GL2(Z£), the product being over all primes 

£, and let H denote the image of Gal (Q/Q) in G under pE- For n ^ 1 an integer, there is a 
natural projection map from G to GL2(Z/?7,Z); let 

r„:=ker(G'^GL2(Z/nZ)). 

By Serre's open image theorem, the index (G : H) is finite, hence there exist n such that 
r„ < H; let m denote the smallest such n. (In order to show that the growth of n^^. is 
"regular", it is convenient to work with a large subgroup Yl^Ki C H, with each Kg having 
simple structure.) 



ON THE AVERAGE EXPONENT OF ELLIPTIC CURVES MODULO p 19 

Now, the image of Gal (Q/Q) in GL2(Z/A;Z) can be obtained by composing the maps 

and hence 

nL, = [Li,:Q] = \H/HnTk\. 

Write m = HpimP™^ ^^"^ ^^^ ^ ^ WrAkP^^ t)e given. 
Claim: If kp ^ mp for some p and a ^ 1, then 

|iJ/iJ n Tpa.l.\ = \H/H n Ffcl ■ \Tpkp/Tpa + kp\. 

Moreover, if kp = 0, we have Tpkp/Tpa+kp = Ti/Tpa = GL2(Z/p"Z), and ii kp > then 

IP /p I „4a 

|J- pfep/J- ptt+fep I — /^ • 

Proof of claim: We note that 

\H/H n rp..fc| = \H/H n Tfcl • |(i/ n rfe)/(iJ n r^..^)] 

and 

|(i7nrfc)/(r^nrfc)|-|(r^nrfc)/(r^nrp.fc)| 

Let A^ = Tm n Tk and S = H n Tpaj.. Since Fm < -f^ and (trivially) Tpa^ < Tk, we find that 

snN = {Hn Tpak) n (r^ n r^) = r^ n Tpa^. 

Moreover, since kp ^ nip, given any hi G -ff fl F^ we can find 1x2 E H r\ Tpa^ such that 
^1 = ^2 ■ (1, 1, • • • 5 1, 7p5 1, 1, • • O' where 7p = I + p^pM and M G Mat2(Zp), and consequently 

S-N = {Hn Tpak) ■ (F„ n Ffc) = i/ n Ffc. 

Now, by the second isomorphism theorem of group theory, SN/N = S/S fl A^, hence 

{H n Ffc)/(F^ n Ffc) = SN/N = s/snN = {Hn Fp.fc)/(r™ n Fp^^), 

which, together with (7.1), implies that 

\{H n Tk)/{H n Tpa.k)\ = |(F„ n Ffc)/(F„ n Fpa,)|. 

With [a, b] denoting the least common multiple of two integers a, b, we have FaflF;, = Tia,b]- 
Further, if a | 6 and {ab, c) = 1, then Tac/^bc — ^a/^t- Thus, again using that kp ^ rrip, we 
find that 

(Fm n Tk)/(Tm n Tpak) = F[m,fc]/F[m,paA;] = Tpkp/Tpkp+a. 

Hence 

\H/HnTpa.k\ = \H/HnTk\ ■ \{HnTk)/{HnTpa.k)\ = \H/HnTk\ ■ \T^kp/T^kp+al 
and the first part of the claim is proved. The latter part of the claim follows from 

a+kp — l 
j^kp 

together with Fpj/Fpj+i = Fp/Fp2, and |Fp/Fp2| = p^. 
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Now, let (m) be the set containing 1 and the positive integers composed only of primes 
dividing m. For any k we have k = hj with h G (m) and {j,m) = 1. We can further write 
h = hih2 in a unique way with hi \ m, {hi, /i2) = 1, and Up > rrip for every p \ /i2, where p'^*'||/i2 
and p'"p||?n. From the above claim it follows that nif. = ul^ ■ ul , that ul. = |GL2(Z/jZ)|, 
and that 



(/ii) JJ/^'^"-'"^) 



riL^ =rE[hi) IIP 

p\h2 

where rE{hi) is a rational number depending only on E and hi, p'^p\\h2, and p^^pWm. 
We therefore have 



-l)^W0(rad(/i)) 



c 



/iriL^ 


g^ 


11 


(g2- 


l)(g5 


-1) 






with c as defined in (1.2). Using the fact that n^^ = VE^hi) Y[p\h2P'^^'^'' '"''^' ^^ ^^ ^ straight- 
forward matter to show that the sum over h G (m) is equal to the rational number 

TT /^1 g - ^ W (-l)-("^)0(rad(/ii)) yr [^ q-l 



The CM case is similar, except that til j, (for all but finitely many q and k ^ 1) equals 
(g — 1)2 ■ g2{fc-i) if g splits in J'i', and is equal to (g^ — 1) . g2(fc-i) jf ^ jg jj^g^.^ j^^ j;^_ (Recall 
that K denotes the quadratic imaginary field that contains the order by which E has CM.) 

8. Further remarks on the error terms 

Wu [22] has simplified the calculations involved in the proofs of Theorems 1.1 and 1.2, 
and improved on the error terms given by us. In the unconditional CM case, Kim [9] has 
made further improvements by using a different approach, namely using class field theory 
and a Bomb ieri- Vinogradov type theorem for number fields due to Huxley [8]. 

More precisely, in the case where E has CM, Wu obtained an error term of size 
0£;((logX)~^/^^)), improving on our original error term O^ (log log log X/ log log X); in fact 
his method, on noting that rii^ ^ k^ holds in the CM case (cf. (3.2)), gives an error term 
of size 0£;((logX)~^'*). In [9] Kim greatly improved on the error term in the CM case, by 
showing that for any A > we have, unconditionally. 

Regarding conditional results, Wu [22] has shown that on GRH, 

J2ep = CE-U {X') + Oe {X''/'{\ogXy/') , 
pi:x 
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whether or not E has CM. It is worth noting that on GRH, Wu's treatment, together with 
separating out supersingular primes, gives an improved error term in the case where E has 
CM, namely E^^x ep = ce ■ Li (X^) + Oe (X7/4(logX)i/2) . 

We will now outline Wu's argument by sketching a proof of this GRH-conditional CM 
result. As in the proofs of Theorems 1.1 and 1.2, the problem reduces, via partial summation 
and the Hasse bound, to showing that 

J2^ = CE-U{X)-\l + Oe (x-3(logX)i)| . (8.1) 

p\N 

Briefly, we set Y = Y{X) := X4(logX)~2. As in the proofs of Theorems 1.1 and 1.2, we use 
the fact that 4- = y'l,,^ ^^ to obtai 



am 






5:+ E \j:^ e 



k<:y Y<ksi2VX ) hj=k ps^X 

p\N ^ ' p\N,k\dp 



In considering the sum over Y < k ^ 2V X, we note, as we did in the proof of Lemma 3.6(b), 
that only the primes of ordinary reduction contribute. Then, again as in the proof of Lemma 
3.6(b), we use the trivial estimate \Sj{X] D,k)\ <^ ^ + ^. Thus, 

E E^ E i« E E i«f + vJiogx 

Y<k^2Vxhj=k p^X y<ki:2^/X P^^ 

p\ N, k \ dp p\ N, k\ dp 

ap^O 

We use Lemma 3.3(b) to handle the sum over k ^Y, obtaining 

^(^> E i.u(x)$:-L5:^ + o(yyx.og(xiv)). 



EE 



J r^ t:: ^L, tTT. J 



k^Y hj=k •" p^X ks^y " hj=k 

plj N, k\d. 



We complete the sum, applying Lemma 3.4 to bound the error that arises. Combining every- 
thing, we obtain ^p^x ^ = c^^-Li (X) (^1 + Oe (^^^^ + ^)) • Since Y = X3(logX)-i, 



p\N 

this gives (8.1). 
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